Home / server / Questions / 461528
Accepted
Jez
Asked: 2012-12-29 12:11:49 +0800 CST

How does the ssh-keygen .pub format work with .pem files?

  • 772

The ssh-keygen command generates .pub files which it describes as "public key files", but they are a totally different format to most "public key files" I've usually seen, which are in PEM format. The ssh-keygen-style files look like this:

ssh-rsa AAAAB3NzaC1... user@host

... whereas the PEM files look like this:

-----BEGIN CERTIFICATE-----
MIIGZjCCBU6gAwIBAgIDCIrNMA0GCSqGSIb3DQEBBQUAMIGMMQsw...
-----END CERTIFICATE-----

Are these two formats interchangeable, or are they performing a fundamentally different purpose? I came across this problem because I wanted to get the RSA2 key fingerprint of my PEM-encoded public key file, but the method usually suggested to do it (ssh-keygen -l) says that my PEM-encoded file "is not a public key file".

By the way, I'm aware of this answer, but it doesn't cover the .pub files generated by ssh-keygen.

ssl

1 Answers

  1. Best Answer

    OpenSSH key pairs are not PEM or any other x500 standard. New versions of OpenSSH can use X.509 PEM keys, but that's another ball of wax separate from ssh-keygen, and has to be configured explicitly. As best I know, no major implementation of SSH uses the exact same key formats as any other.

    As Zoredache notes, if you're using something other than OpenSSH (deus iuvo vos), then it could be darn near anything.

    • 9